{"id":113253,"date":"2024-01-30T13:41:05","date_gmt":"2024-01-30T11:41:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg"},"modified":"2024-01-30T13:41:05","modified_gmt":"2024-01-30T11:41:05","slug":"uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimosti-v-realizaczii-jpeg-xl-iz-sostava-ffmpeg","title":{"rendered":"Schwachstellen in der Implementierung von JPEG XL in FFmpeg","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Details have been revealed about two vulnerabilities in the JPEG XL decoder provided in the FFmpeg package, which could lead to the execution of malicious code when processing specially crafted images in FFmpeg. The issues were fixed in the FFmpeg 6.1 release, but since JPEG XL support is included starting from version 6.1, the vulnerability only affects systems using experimental builds of FFmpeg 6.1 or backporting changes from it. <\/p>\n
The first vulnerability (CVE-2024-22860) is caused by an integer overflow in the JPEG XL parser due to a lack of bounds checking on the int type size. The second vulnerability (CVE-2024-22862) arose from an integer overflow in the jpegxl_anim_read_packet function used for decoding animations, and is related to the use of signed int64_t instead of unsigned uint64_t. The issues are specific to FFmpeg and do not manifest in the reference implementation of libjxl. \n Quelle: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"